not verifying certs for TLS to IP address / Winssl

VULNERABILITY

When asked to do a TLS connection (HTTPS, FTPS, IMAPS, etc) to a URL
specified with an IP address instead of a name, libcurl would wrongly not
verify the server's name in the certificate. The signature (whether it was
signed by a trusted CA) and validity (whether the date was within the
certificate's lifetime and it was not revoked) verifications were still
performed.

This is a problem in libcurl built to use the SChannel/Winssl TLS backend.
SChannel/Winssl is the native library provided by Microsoft Windows.

Only users on Windows can be affected by this. And only if libcurl was built
to use the native TLS backend library.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2014-2522 to this issue.

CWE-297: Improper Validation of Certificate with Host Mismatch

AFFECTED VERSIONS

This flaw has existed ever since libcurl started to support the
SChannel/Winssl backend.